[Security] Keep the 1Password lock flock out of world-writable /tmp

[Chessing234]

Summary

• omarchy system lock flocked ${XDG_RUNTIME_DIR:-/tmp}/omarchy-1password-lock.lock
• A local user who held that path in /tmp made flock -n || exit 0 skip 1password --lock
• Stage the flock under $XDG_RUNTIME_DIR (or a 0700 /tmp/omarchy-$UID fallback). If the private lock file cannot be created, still lock

Test plan

• bash test/shell.d/system-lock-test.sh
• Lock a session with 1Password running and confirm the flock is not /tmp/omarchy-1password-lock.lock

[Chessing234]

@dhh @ryanrhughes ready for review

[Chessing234]

folded into #12066 for a single review.